Legal

Privacy Policy

Last updated: March 2026

BASAL is a local-first tool. This policy covers what the cloud service at basal.is collects. The CLI and local runtime do not send telemetry or usage data to basal.is.

Operator

The basal.is cloud service is operated by Agora Innovation Limited, a private company incorporated in the Dubai International Financial Centre (DIFC), registered number 12487. Registered address: DIFC Innovation One, Dubai International Financial Centre, United Arab Emirates.

What basal.is collects

When you sign in and use basal.is, we collect:

  • Google profile — name, email address, and profile picture (via Google OAuth)
  • API key metadata — key name, creation date, last-used timestamp, SHA256 hash of the key
  • Proxy usage logs — timestamp, token count, model tier, API key ID, response status
  • Standard web logs — IP address, browser user agent, page visits on basal.is

What basal.is does not collect

  • Workspace content — documents, transcripts, emails, calendar events
  • Knowledge graph data — entities, facts, relationships, decisions
  • LLM prompts or responses — the proxy forwards requests without logging content
  • Local filesystem data — artifacts, workspace files, configuration
  • CLI telemetry — the CLI does not phone home

How we use your information

  • Authentication — your Google profile identifies your account and API keys
  • Rate limiting — proxy usage logs enforce per-key request and token limits
  • Abuse prevention — usage patterns help detect and prevent misuse of the proxy

Data retention

  • Account data is retained while your account is active
  • Proxy usage logs are retained for 90 days
  • Revoked API keys are soft-deleted (hash retained for audit, raw key already not stored)

Your rights

  • Access — view and manage your API keys via the BASAL desktop app or CLI
  • Deletion — revoke keys and request account deletion via privacy@basal.is
  • Local data — you control all local data directly; delete your project directory and ~/.basal/ at any time

Third-party services

Sign-in uses Google OAuth; your profile data is subject to Google's privacy policy. We use trusted infrastructure providers for hosting and authentication. Data is processed only as necessary to operate the service.

Contact

For privacy questions, contact us at privacy@basal.is.